Blind Signing and Transaction Manifests

Overview

Blind signing is the practice of signing transactions whose effects you cannot verify. On Ethereum, users routinely approve transactions that are opaque hexadecimal data – they cannot see what the transaction will actually do until after it executes.

The Cost

On Ethereum an application spends a user's tokens through an ERC-20 allowance: the user calls approve, which lets a spender withdraw from the account "multiple times, up to the _value amount" (EIP-20). The wallet shows that call as contract data, so a user who approves a malicious spender has let it withdraw those tokens at any later time.

How Radix Solves This

Radix transaction manifests are human-readable lists of the asset movements a transaction will make. The Radix Wallet parses these manifests and shows users exactly which assets will move, where they'll go, and what they'll receive – before signing.

This is equally important for AI agents – autonomous agents can read and verify manifests programmatically, never blind-signing a transaction they don't understand.

What happened in the Badger DAO hack, and could it happen on Radix?

Badger DAO is an Ethereum application that pays yield on wrapped bitcoin. In the weeks before 2 December 2021, someone altered its website so that ordinary deposit and reward-claim transactions carried an extra approval, which let the attacker's address spend the user's tokens; the victim in one documented case signed an increaseAllowance call about six hours before the drain (Rekt). Wallets showed those approvals as contract data, so users signed them without seeing what they granted. From 00:00 UTC on 2 December the attacker used the approvals to withdraw about $120m in wrapped bitcoin and other ERC-20 tokens, about 900 byvWBTC worth over $50m in a single transaction, until Badger paused its contracts some two hours later (Rekt).

An RDX Works post of April 2022 explains why the same attack has no counterpart on Radix (Radix Blog). A Radix account is a component that holds its tokens in vaults, and a transfer moves tokens from one vault to another, so there is no allowance for a spender to draw on later. Because the wallet shows the manifest's token movements, a hijacked site could at most ask a user to sign one swap that visibly gives the wrong thing back, such as wrapped bitcoin for a fake token, rather than a standing permission. The same post accepts that some users would still sign such a swap: the manifest limits what one bad signature can take and puts it in plain view, but the user still has to read it.

Human-Readable by Design

A manifest describes a transaction as a sequence of concrete asset movements rather than an opaque call to a contract. A swap reads "withdraw 10 X tokens from my account, pass those tokens to the Swapper component, then deposit the tokens that it returns back to my account". Because the intent is explicit, the Radix Wallet "can show a clear, meaningful summary of exactly what's going to happen" before the user approves it (Radix Learn: What are Transaction Manifests). Every instruction a manifest can contain is listed in the manifest instruction reference.

Built-in Guarantees

Manifests go further than transparency: they let the user assert guarantees on the outcome. In a token swap, the manifest can require a minimum return – if a swap would return less than the amount the user specified, "call the whole thing off" and revert the entire transaction (Radix Learn). This protects users against slippage, front-running, and buggy or malicious components regardless of what the underlying code does; on Ethereum the user trusts the swap contract to make the token contracts update balances correctly (Radix Learn). Autonomous AI agents gain the same guarantees for free, since they read and construct the very same manifests.